Assigned to automation?

Hello

I have ran into an issue with my defender logs.
Since march 13th i stopped seeing incidents being assigned to automation in my log management tool.
We are using Splunk to get an overview for how many incidents the AiR is handling, but since march 13th it seems that incidents are no longer getting assigned to automation.

In the picture below you can see that a high volume of incidents are getting "null" as the value of assigned to, which i believe to be what should have been assigned to "Automation"

Is there anyone with similar issues or knows what the reason could be?